Repository navigation
fix: preserve compensation identity and monotonic progress - #364
Merged
Merged
Conversation
…ompensation-request-recovery
…nsation-mutation-guards
…ompensation-mutation-guards
…ompensation-mutation-guards
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A malformed compensation CAS could write a foreign tenant or changed source identity into a record while its indexed scope stayed unchanged, leaving the run unreadable to validated readers. Validate caller scope and require the next revision to advance by exactly one within the signed storage range. Bind continuity, source instance and original creation identity in each backend's atomic UPDATE; stale or changed identities write nothing. Preserve normal competing claims and encrypted parameters.
At the final SQL-storable version, claim now returns a clear 409 without changing the run instead of reaching a storage error and returning 500. Both the malformed-tenant write and version-limit API failures were reproduced before their fixes.
Validation: 86 Rust tests (56 compensation storage cases across plain/encrypted PostgreSQL and SQLite, 14 continuity cases, 16 HTTP safety cases); all 350 lifecycle/isolation/invariant/compensation/runtime E2E cases on the exact isolated server and PostgreSQL; strict all-target Clippy across storage/engine/API/gRPC/CLI/mobile; formatting, typecheck and docs. No schema or dependency changes.
Builds on #363 and #362; merge after those prerequisite heads pass CI and tested-tree proofs. Invocation-specific immutable rules/parameters, offline owner acknowledgement and explicit archival outcomes remain required review work.
The recovery OpenAPI repair is included. The combined branch passes all 367 API library tests, all 16 HTTP safety cases and strict all-target API Clippy. This synchronization changes documentation and generated API contracts; runtime handler bodies and mutation guards are unchanged.
The CI generated-client gate caught the expected OpenAPI fingerprint change. The representative Rust and JavaScript clients regenerate, compile/check and execute successfully; the regenerated contract fingerprint is updated and the complete generated-client gate passes locally.